Heap-Based Buffer Overflow in GNU Aspell Affects Dictionary Loader

CVE-2026-103658

What is CVE-2026-103658?

GNU Aspell versions up to 0.60.8.2 are vulnerable to a heap-based buffer overflow in the read-only dictionary loader. This vulnerability arises from the improper handling of a signed integer during capacity checks, which can lead to heap memory corruption. By crafting a malicious .rws file with an oversized length field, an attacker may cause out-of-bounds writes, posing risks of denial of service and potentially allowing code execution. The flaw has been addressed in version 0.60.8.3.

References